From fb08fc89a7634b6858097bfc048c80456ab1096e Mon Sep 17 00:00:00 2001 From: rbecwar Date: Thu, 8 Apr 2021 15:11:25 -0500 Subject: [PATCH 1/6] added new detection --- ...spicious_command_executed_as_a_service.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 detections/endpoint/suspicious_command_executed_as_a_service.yml diff --git a/detections/endpoint/suspicious_command_executed_as_a_service.yml b/detections/endpoint/suspicious_command_executed_as_a_service.yml new file mode 100644 index 0000000000..3785f31959 --- /dev/null +++ b/detections/endpoint/suspicious_command_executed_as_a_service.yml @@ -0,0 +1,46 @@ +name: Suspicious Command Executed as a Service +id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 +version: 1 +date: '2021-04-07' +author: Ryan Becwar +type: batch +datamodel: +- Endpoint +description: This detection is to identify the abuse the Windows SC.exe to + execute malicious commands or payloads via PowerShell. +search: ' `wineventlog_system` EventCode=7045 Service_File_Name IN ("*powershell.exe*", "*-nop*", "*hid*") +| stats count min(_time) as firstTime max(_time) + as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)`' +how_to_implement: To successfully implement this search, you need to be ingesting Windows System + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Creating a hidden powershell service is rare and could key off of those instances. +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf +- http://az4n6.blogspot.com/2017/ +- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier +tags: + analytic_story: + - malicious_powershell + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1569.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - EventCode + - Service_File_Name + - Service_Type + - _time + - Service_Name + - Service_Start_Type + - Service_Account + - user + security_domain: endpoint From 517b71db73302bfc537915e7f767f7fbbb553bb8 Mon Sep 17 00:00:00 2001 From: rbecwar Date: Thu, 8 Apr 2021 15:24:46 -0500 Subject: [PATCH 2/6] Update and rename suspicious_command_executed_as_a_service.yml to malicious_powershell_executed_as_a_service.yml --- ...vice.yml => malicious_powershell_executed_as_a_service.yml} | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) rename detections/endpoint/{suspicious_command_executed_as_a_service.yml => malicious_powershell_executed_as_a_service.yml} (94%) diff --git a/detections/endpoint/suspicious_command_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml similarity index 94% rename from detections/endpoint/suspicious_command_executed_as_a_service.yml rename to detections/endpoint/malicious_powershell_executed_as_a_service.yml index 3785f31959..0cf9bac9fc 100644 --- a/detections/endpoint/suspicious_command_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -12,7 +12,8 @@ search: ' `wineventlog_system` EventCode=7045 Service_File_Name IN ("*powershell | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)`' +| `security_content_ctime(lastTime)` +| `malicious_powershell_executed_as_a_service_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. From ee29693ccaccac5c788e26bd993fc0449c99e8cc Mon Sep 17 00:00:00 2001 From: rbecwar Date: Thu, 8 Apr 2021 15:25:49 -0500 Subject: [PATCH 3/6] Update malicious_powershell_executed_as_a_service.yml --- .../endpoint/malicious_powershell_executed_as_a_service.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 0cf9bac9fc..4a510f10c0 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -1,4 +1,4 @@ -name: Suspicious Command Executed as a Service +name: Malicious Powershell Executed As A Service id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 version: 1 date: '2021-04-07' From 51d51afc5bf881605b7f2193c1957c4fba070759 Mon Sep 17 00:00:00 2001 From: divious1 Date: Mon, 12 Apr 2021 12:51:17 -0400 Subject: [PATCH 4/6] adding test file --- ...licious_powershell_executed_as_a_service.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/malicious_powershell_executed_as_a_service.test.yml diff --git a/tests/malicious_powershell_executed_as_a_service.test.yml b/tests/malicious_powershell_executed_as_a_service.test.yml new file mode 100644 index 0000000000..b2d93a1a8f --- /dev/null +++ b/tests/malicious_powershell_executed_as_a_service.test.yml @@ -0,0 +1,12 @@ +name: Malicious Powershell Executed As A Service Unit Test +tests: +- name: Malicious Powershell Executed As A Service + file: endpoint/malicious_powershell_executed_as_a_service.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog From 8a515a138a32ce7b3eda420c4753617e2bb92b06 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 12 Apr 2021 15:16:30 -0700 Subject: [PATCH 5/6] Update malicious_powershell_executed_as_a_service.yml updating story name --- .../endpoint/malicious_powershell_executed_as_a_service.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 4a510f10c0..96cb82c4ee 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -24,7 +24,7 @@ references: - https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier tags: analytic_story: - - malicious_powershell + - Malicious Powershell dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log kill_chain_phases: From 72e9955f0ac9cd577847cbd276ee1361c3b0772b Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 12 Apr 2021 15:37:38 -0700 Subject: [PATCH 6/6] move test file to endpoint folder --- .../malicious_powershell_executed_as_a_service.test.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/{ => endpoint}/malicious_powershell_executed_as_a_service.test.yml (100%) diff --git a/tests/malicious_powershell_executed_as_a_service.test.yml b/tests/endpoint/malicious_powershell_executed_as_a_service.test.yml similarity index 100% rename from tests/malicious_powershell_executed_as_a_service.test.yml rename to tests/endpoint/malicious_powershell_executed_as_a_service.test.yml